Friend, Foe, or Target? Domain Models as Risk Deterrents, Risk Sources, and Assets at Risk

Abstract

Modelers and organizations often struggle to assess the benefits and drawbacks of modeling activities. This paper proposes addressing this challenge through a risk-oriented lens, leveraging the Common Ontology of ValuE and Risk (COVER) and the Reference Ontology for Security Engineering (ROSE). The proposal focuses on identifying assets at risk throughout the modeling process to clarify: when models mitigate risks and contribute to cost savings (models as risk deterrents), when models introduce risk to other assets (models as risk sources), or when they are vulnerable to risk events themselves (models as assets at risk), potentially generating additional costs. This perspective enables modelers and organizations to evaluate the benefits and costs of modeling practices, aligning investments with organizational goals, while helping researchers identify gaps for enhancing modeling languages, methods, and tools. The proposal is evaluated by analyzing case studies from the literature and interviews with nine professionals and researchers.